Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About marcusnilssonmr
marcusnilssonmr
Path Finder
Member since:
02-16-2015
06-05-2020
Community Statistics
| Posts | 20 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 8 |
| Member Since | 02-16-2015 |
Activity Feed
- Karma Splunk DB Connect: How do dbmon tail inputs work when configured on a search head cluster or pool? for Lucas_K. 06-05-2020 12:47 AM
- Got Karma for Does multisearch suffer from subsearch limits?. 06-05-2020 12:47 AM
- Got Karma for Does multisearch suffer from subsearch limits?. 06-05-2020 12:47 AM
- Got Karma for Why is the memory usage high on the indexer when running a simple stats count search?. 06-05-2020 12:47 AM
- Got Karma for Is there a way to limit memory usage of the stats command?. 06-05-2020 12:47 AM
- Got Karma for Is there a way to limit memory usage of the stats command?. 06-05-2020 12:47 AM
- Got Karma for Is there a way to limit memory usage of the stats command?. 06-05-2020 12:47 AM
- Got Karma for Re: db connect 2 input: java date timestamp adding extra month. 06-05-2020 12:47 AM
- Got Karma for How to convert monetary values to a single currency? Is there an app to provide exchange rates for this calculation?. 06-05-2020 12:47 AM
- Karma Limit how far back you can retrieve data regardless of timerangepicker selection for Ant1D. 06-05-2020 12:46 AM
- Posted AMQP Messaging Modular Input: What is the best way to use multiple threads for an AMQP input? on All Apps and Add-ons. 11-22-2016 12:26 PM
- Tagged AMQP Messaging Modular Input: What is the best way to use multiple threads for an AMQP input? on All Apps and Add-ons. 11-22-2016 12:26 PM
- Posted How to convert monetary values to a single currency? Is there an app to provide exchange rates for this calculation? on Splunk Search. 11-17-2015 09:54 AM
- Tagged How to convert monetary values to a single currency? Is there an app to provide exchange rates for this calculation? on Splunk Search. 11-17-2015 09:54 AM
- Tagged How to convert monetary values to a single currency? Is there an app to provide exchange rates for this calculation? on Splunk Search. 11-17-2015 09:54 AM
- Posted Re: db connect 2 input: java date timestamp adding extra month on All Apps and Add-ons. 11-15-2015 02:07 PM
- Posted Re: Limit unacked messages from AMQP on All Apps and Add-ons. 09-29-2015 05:47 AM
- Posted Re: Limit unacked messages from AMQP on All Apps and Add-ons. 09-29-2015 04:58 AM
- Posted Splunk mobile access server marked as legacy, alternative? on Splunk Search. 09-25-2015 10:18 AM
- Posted Google Import on Search Head Cluster on All Apps and Add-ons. 09-24-2015 10:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 1 | |||
| 2 |
11-22-2016
12:26 PM
What is the best way to have multiple threads (to use multiple cores) importing events from an amqp queue? Just duplicate the stanzas?
... View more
11-17-2015
09:54 AM
1 Karma
We have events containing amounts in different currencies that we would like to normalize into euros (for example). Is there a good app to provide exchange rates for this calculation?
... View more
11-15-2015
02:07 PM
1 Karma
Try yyyy instead of YYYY. The fomat YYYY is weakyear, which can give weird results.
... View more
09-29-2015
05:47 AM
Works, thx!
... View more
09-29-2015
04:58 AM
Latest version seems to be 0.8?
... View more
09-25-2015
10:18 AM
Splunk mobile access server is marked as legacy in the documentation, what is the alternative?
... View more
- Tags:
- mobile-access-server
09-24-2015
10:41 AM
The Google Import app supports importing google sheets to a lookup table. Does this work on a search head cluster? Will the import run on the captain only or on all nodes? Will the lookup exist on all nodes?
... View more
09-22-2015
07:04 AM
I am using AMQP Messaging Modular Input to import messages from a RabbitMQ queue. When there are lots of messages in the queue and the Modular Input is started, it consumes (without ack) all messages (100k). My understanding from the settings is that it should only consume 10 at a time? How do I set a limit to cap my memory usage?
... View more
09-10-2015
09:59 PM
When I use earliest=-1d in Restrict search terms and search for 1 hour, I still get 1 day. So it seems it does not intersect the time range, it replaces it. Is there a way to have the time become a restriction, and not a replacement?
... View more
08-21-2015
06:05 AM
What capability is needed to create a new index? There is a capability for editing an index, is that used for creation as well?
... View more
- Tags:
- capabilities
06-18-2015
05:30 AM
3 Karma
I am executing a search like the following:
index=x sourcetype=t | eval {Property} = Value | stats latest by ID
This takes memory proportional to the amount of rows, and for all time, that means more than 10G of memory. I understand that stats needs to keep an accumulator, but I would like it to limit the amount of memory and start using disk instead, meaning a slower search, but less memory usage.
Can I limit the memory usage of stats this way?
... View more
06-15-2015
02:14 PM
context.stanzaName is not accessible from classes outside of the package, otherwise it compiles fine.
... View more
06-15-2015
02:02 PM
The pluggable architecture make sense, thanks!. It would be very convenient though, if some more default handlers shipped with the plugin for some obvious choices, such as dumping as is (as you json handler above), and in a format compatible with KV_MODE=auto_escaped.
... View more
06-10-2015
04:15 AM
Splunk DB Connect seems to save "tail_rising_column_checkpoint_value" in inputs.conf, and it doesn't seem to be replicated in a search head cluster environment. When I look at the DB Input in the UI on each Search Head, they show different checkpoint values.
Should I whitelist inputs.conf for clustering to solve this, or how is this supposed to work?
... View more
06-07-2015
07:54 AM
2 Karma
- Tags:
- multisearch
06-07-2015
01:31 AM
Can we get the modular input to escape properly? Then all that is needed is a kvmodr that handles escaping.
... View more
05-31-2015
09:45 PM
That is what I want Splunk DB Connect 2 to do, that app is formatting the event.
... View more
05-22-2015
06:24 AM
When indexing columns containing quotes ("), Splunk DB Connect 2 does not seem to quote the values:
x=""", x2="1"
The fields are naturally not interpreted correctly..
Is there a way to make Splunk DB Connect 2 escape values?
When using Splunk DB Connect, the format of the line is compatible with KV_MODE auto, key value pairs inside ". Obviously, this format does not work if the values have " in them.
What I want is for Splunk DB Connect to format lines to be compatible with KV_MODE auto_escaped. For this to work, it would need to replace " with \" automatically (and probably linefeeds as well)
... View more
- Tags:
- Splunk DB Connect
02-20-2015
04:13 AM
I am using Splunk AMQP Messaging Input with RabbitMQ. When posting a message with JSON content, I receive the following event in Splunk:
Fri Feb 20 11:57:56 CET 2015 name="amqp_msg_received" event_id="5" msg_queue="splunk_consume" msg_exchange="x" msg_body="{"x": 5, "y": 5}"
The problem is that since the json contains ", Splunk interprets msg_body as being "{", since the quotes are not escaped. What is the best way to handle this?
... View more
